T09 · Insecure Skill Coding Practices
- Location
SKILL.md:146- Finding
Predictable and Insufficiently Protected Temporary Workspace
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 146–151
Vulnerability Type: Predictable temporary directory, insecure file creation, and potential symbolic-link attacks
Risk Level: MediumVulnerable Code:
bash TASK_ID=$(date +%Y%m%d_%H%M%S) TEMP_DIR="/tmp/openclaw/sn-infographic/${TASK_ID}" mkdir -p "$TEMP_DIR"Subsequent workflow stages write user content and generated artifacts into this directory, including
analysis.json,structured-content.md,expanded-prompt.txt, andround_N.png.Technical Analysis
The temporary directory name is derived from a timestamp with one-second granularity. It is therefore predictable and may collide when multiple tasks start during the same second. The use of
mkdir -pdoes not provide atomic, exclusive directory creation and does not fail if an attacker or another process has already created the path.The workflow does not set a restrictive
umask, explicitly assign owner-only permissions, verify directory ownership, or check whether destination files are symbolic links before writing them. Shell redirections and downstream image writes can consequently follow attacker-created links within a pre-created workspace.No cleanup operation is defined, so prompts, analysis results, and generated images may remain in the shared temporary filesystem after task completion.
Attack Path
- A local attacker identifies the predictable base path
/tmp/openclaw/sn-infographic/. - The attacker predicts a task directory from the current timestamp and creates it before the Skill starts.
- The attacker gives the directory permissive or otherwise attacker-controlled permissions and creates symbolic links for expected files such as
analysis.json,expanded-prompt.txt, orround_1.png. - The Skill executes
mkdir -p, which accepts the existing directory instead of detecting the collision. - Subsequent workflow stages write user data or genera ...[truncated 1217 chars]
- A local attacker identifies the predictable base path
- Remediation
View remediation
Remediation Suggestions
-
Set a restrictive file-creation mask before creating any artifacts:
bash umask 077 -
Replace the timestamp-derived directory with an atomically created, unpredictable directory:
bash BASE_TEMP_DIR="/tmp/openclaw/sn-infographic" mkdir -p -- "$BASE_TEMP_DIR" chmod 700 -- "$BASE_TEMP_DIR" TEMP_DIR=$(mktemp -d "$BASE_TEMP_DIR/task.XXXXXXXXXX") || { echo "Unable to create a secure temporary workspace" >&2 exit 1 } chmod 700 -- "$TEMP_DIR" -
Verify that the base directory and generated workspace are owned by the current process user and are actual directories rather than symbolic links.
-
Create sensitive files with owner-only permissions. For critical writes, use exclusive file creation and reject symbolic links rather than relying solely on ordinary shell redirection.
-
Ensure downstream tools do not follow attacker-controlled symbolic links when opening output files. Where supported, use secure open flags equivalent to exclusive creation and no symbolic-link following.
-
Add guarded cleanup so artifacts are removed when the workflow exits successfully, fails, or receives a termination signal:
bash cleanup() { if [ -n "${TEMP_DIR:-}" ] && [ -d "$TEMP_DIR" ]; then rm -rf -- "$TEMP_DIR" fi } trap cleanup EXIT INT TERM -
If generated images must remain available after worker completion, move only the required final files into an application-controlled output directory and delete all prompt and analysis intermediates immediately.
-